Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: Methods, systems and computer program products for recommendation systems. Embodiments commence by gathering a set of pathnames that refer to content objects of a collaboration system. A tokenizer converts at least some of the pathnames into vectors. The vectors comprise hierarchical path components such as folder names or file names, which vectors are labeled with an indication as to whether or not the folder or file referred to in a particular vector had been clicked on by one or more users. Some portion of the labeled vectors are used to train a predictive model. Another portion of the vectors are used to validate the predictive model. When the model exhibits sufficient precision and recall, the predictive model is then used to predict the probability that a particular user would have an interest in a particular folder or file. The folder name or file name is presented as a collaboration recommendation.

Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates associated with content objects taken from the plurality of content objects. When a document template is identified, template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: Systems and methods for forming collaboration recommendations. Techniques for forming event-based recommendations use time-decayed event values. A shared content management system supports a plurality of users that generate events by interacting with content objects of the shared content management system. Events over the content objects are captured as event objects. Method steps are invoked upon receiving event objects that describes user-to-object interaction events that arise from interactions by users over content objects. Different types of interactions carry different importance values. The importance values can be applied as weights when scoring user-to-object interaction activities. The importance can decay over time. As time progresses and as the importance of older interactions decay, score components of a user-to-object interaction can be updated based at least in part on a time decay function. The system emits collaboration recommendations based on the decayed user-to-user collaboration scores.

Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Handling user-demanded privacy controls over data of an electronic document collaboration system. A storage facility is configured to store content objects and associated metadata that pertains to the content objects. A user raises a privacy action request that comprises a demand to change how certain content objects that contain personally identifiable information (PII) of the user are handled. A plurality of content objects are classified using a PII classifier that is trained using synthetically-generated training set entries where, rather than reading actual contents from electronic documents of the collaboration system to generate training set entries, instead, the training set entries are generated using words that are randomly selected from a repository of natural language words. When PII corresponding to the user who raised the privacy action request is discovered in content objects, then the content management system modifies those content objects and/or its metadata in accordance with the demand.

Abstract: Systems and methods for forming collaboration recommendations. Techniques for forming event-based recommendations use time-decayed event values. A shared content management system supports a plurality of users that generate events by interacting with content objects of the shared content management system. Events over the content objects are captured as event objects. Method steps are invoked upon receiving event objects that describes user-to-object interaction events that arise from interactions by users over content objects. Different types of interactions carry different importance values. The importance values can be applied as weights when scoring user-to-object interaction activities. The importance can decay over time. As time progresses and as the importance of older interactions decay, score components of a user-to-object interaction can be updated based at least in part on a time decay function. The system emits collaboration recommendations based on the decayed user-to-user collaboration scores.

Abstract: Systems and methods for presenting relevant collaboration activity to a collaboration system user. A method embodiment commences upon identifying user events that correspond to interactions between a plurality of users and collaboration objects. The interactions that had been performed and the collaboration objects are both associated with permissions attributes. The interactions are recorded as event records that include aspects of the permissions attributes. When a user opens a user interface, a set of event records is selected based at least in part on the permissions attributes with respect to the user. The selected set of event records are then used to generate a set of user-specific feed entries corresponding to particular individual ones of the set of event records. Characteristics of the individual event records and/or aggregations of event records are used to prepare user-specific feed entries that are presented in a user interface of a user device.

Abstract: Methods, systems, and computer program products for detection of personally identifiable information (PII). A first detector and a second detector are configured to interoperate. The first detector is different from the second detector and the second detector incurs a greater computational cost than the first detector when processing identical content. Content is presented to the first detector so as to implement a first type of PII detection that is based at least in part on regular expression analysis using regular expressions. The content is presented to the second detector. The second detector performs PII detection based on content analysis that is different from the first detector's regular expression analysis. The second detector causes generation of new regular expressions based on the content analysis and the first detector is updated with such new regular expressions. Performance of the first detector is continually improved as new regular expressions are generated.

Abstract: Methods, systems, and computer program products for content management systems. An unlabeled dataset comprising documents that at least potentially comprise personally identifiable information (PII) is used when training a PII content classifier. Such a classifier is trained by (1) determining, based on applying a PII rule to a first portion of a document selected from the unlabeled dataset, a confidence value that the first portion of the document does contain personally identifiable information, (2) selecting a second portion of the document selected from the unlabeled dataset such that the second portion does not include the first portion; and (3) assigning, based on the confidence value, a likelihood value that corresponds to whether characteristics of the second portion are indicative that the document does contain personally identifiable information. Such a PII content classifier is used over selected portions of subject content objects to determine whether the selected portions contain PII.

Abstract: Methods, systems and computer program products for content management systems. A content management system is configured to manage a plurality of content objects. Unsupervised learning is performed over the plurality of content objects to identify document templates that are associated with content objects taken from the plurality of content objects. When a document template is identified, then template metadata is associated with the document template. Additional content objects that are similar to the document template can take on the template metadata as well. In this way, many documents can be automatically populated with template metadata that corresponds to the identified document template. All or portions of the template metadata can be applied to policies, which policies serve to marshal ongoing document handling operations. During learning, document features are extracted and analyzed so as to define feature clusters, which feature clusters are in turn are used to form document template clusters.

Abstract: Content object operations over content objects of a content management system are prioritized to be performed immediately, or at a later time. The immediate scheduling of an operation is determined by policies, rules, and/or predictive model outcomes. The determination for later time scheduling is based on analysis of a history of events on content objects. If the content object operation is deemed to be at least potentially delayable to a later time, then a scheduling model is consulted to determine an urgency of performing the content object operation on the content object. The urgency value resulting from consulting the scheduling model is combined with then-current resource availability to determine a timeframe for performance of the content object operation on the content object relative to other entries in a continuously updated list of to-be-performed operations. The performance of the content object operation on the content object is initiated in due course.

Abstract: Systems and methods for filtering collaboration activity to present in an activity feed. A cloud-based collaboration system is configured to identify collaboration interactions that users have taken over collaboration objects. Some of the collaboration objects or interactions are subject to access permissions as well as policy-based access rules. When a subject user interacts with a user interface, system components select a first set of user interaction events that in some way pertain to the subject user. A first filtering pass applies a first filter to determine object access permissions. After reducing the first set to a smaller second set, then a second filter corresponding to policy-based access rules is applied to the second set to form a still smaller third set of user interaction events. Characteristics of user interaction events in the third set are used to generate user-specific activity feed entries that are presented in a user interface.

Abstract: System and methods for summarizing collaboration activity events into a plurality of pages that are then scored with respect to user-specific relevance that is based on a set of comprehensibility characteristic parameters. The collaboration activity events are summarized into groups of activities based on certain common attributes that are deemed to have quantitatively measurable relevance to the user. The groups of activities are assembled into a plurality of personalized candidate pages. The candidate summary pages are then scored using a function that includes parameters that serve to quantify how interesting or readable the particular user would find the particular candidate summary page. One or more of the higher scoring candidate summary pages are selected for presentation to the user.

Abstract: System and methods for summarizing collaboration activity events into a plurality of pages that are then scored with respect to user-specific relevance that is based on a set of comprehensibility characteristic parameters. The collaboration activity events are summarized into groups of activities based on certain common attributes that are deemed to have quantitatively measurable relevance to the user. The groups of activities are assembled into a plurality of personalized candidate pages. The candidate summary pages are then scored using a function that includes parameters that serve to quantify how interesting or readable the particular user would find the particular candidate summary page. One or more of the higher scoring candidate summary pages are selected for presentation to the user.

Abstract: Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system. The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.

Abstract: Systems and methods for on-demand generation of customizable collaboration network graphs. A method embodiment operates in a collaboration system that comprises content objects that are operated on by a plurality of users. Interactions with the content objects are detected and streamed into a customizable graph platform. Customization is accomplished by configuring the graph platform to gather particular events and corresponding data that pertain to the entity interaction events and/or to the users that raised the events. The graph platform organizes the data into data structures that codify a collaboration network graph, where the nodes of the collaboration network graph refer to customizable ones of the content objects and where the edges of the collaboration network graph refer to customizable parameters or values that characterize relationships between connected nodes of the collaboration network graph.

Abstract: Systems for identifying misappropriation of forensically-watermarked video content. A method embodiment for forensic watermarking commences upon identifying video sources. A video is partitioned into frame ranges or “chunks”. Different watermarking schemes are applied to the chunks to generate different watermarked versions of each chunk. Upon receiving a request from a user to view a requested video, a digital signature is generated from a set of request attributes such as a user ID or session ID. A video stream is assembled wherein the stream chunk order comprises a particular recoverable sequence of the differing watermarked chunks, where the sequence is based on bit sequences of the digital signature. A misappropriated video or portion thereof can be analyzed to identify the particular recoverable sequence or portion thereof. Based on the recoverable sequence, the digital signature can be recovered, and based on the digital signature, the source of the misappropriation can be determined.